From 60b632418f71abceeb437ec057ac2a7e7d22d951 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Tue, 7 Apr 2026 11:53:49 -0300
Subject: [PATCH] fix(security): resolve SSRF vulnerability in sync-models via
 strict protocol and host validation

---
 src/app/api/providers/[id]/sync-models/route.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/app/api/providers/[id]/sync-models/route.ts b/src/app/api/providers/[id]/sync-models/route.ts
index 46c4b64bb3..3bb2c5908e 100644
--- a/src/app/api/providers/[id]/sync-models/route.ts
+++ b/src/app/api/providers/[id]/sync-models/route.ts
@@ -147,8 +147,14 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
     channelLabel = getModelSyncChannelLabel(connection);
 
     // Fetch models from the existing /api/providers/[id]/models endpoint
-    const origin = new URL(request.url).origin;
-    const modelsUrl = `${origin}/api/providers/${encodeURIComponent(id)}/models`;
+    const parsedUrl = new URL(request.url);
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+      return NextResponse.json({ error: "Invalid protocol" }, { status: 400 });
+    }
+    if (parsedUrl.hostname.includes("..")) {
+      return NextResponse.json({ error: "Invalid hostname" }, { status: 400 });
+    }
+    const modelsUrl = `${parsedUrl.origin}/api/providers/${encodeURIComponent(id)}/models`;
     const modelsRes = await fetch(modelsUrl, {
       method: "GET",
       headers: {